WaratekVRT Sign in

CVE-2013-6357 Apache Tomcat

Affected softwareApache Tomcat
Severity6.8 Medium CVSS 2.0
WeaknessCross-site request forgery (CWE-352)
Published13 Nov 2013
Updated17 Jun 2026

Disputed. The record is tagged disputed: someone contests that the vulnerability exists. We still show our assessment, because the dispute is about whether the vulnerability exists, not whether Waratek can block it.

Description

Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI. NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator.

Exploitation status

Working exploit published

A reviewed exploit catalogue lists ready-to-run exploit code for this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 1 indexed Published artifacts you can open, in Exploit-DB; first seen 2013-11-04.
  • EPSS 2.5% chance in 30 days
IndexArtifactStarsFirst seen
Exploit-DB Apache Tomcat 5.5.25 - Cross-Site Request Forgery 2013-11-04

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection none
  • Action unverified
  • Review automated Inferred
  • Record disputed disputed
Decided by An indexed exploit clearing the evidence bar to reverse-engineer, where there is no source to read
Finding Mitigation candidate: 1 public proof-of-concept exploit(s) are indexed for this CVE (exploit-db), but the affected code is not open source. That makes an ARMR patch rule a candidate rather than a plan. The exploit gives a reproducible entry point to trace inward from and a test to validate a hook against, which is what makes reverse engineering tractable at all. No rule exists and none is scheduled: the hook point must be recovered by decompiling the affected code, and a closer look may find none that ARMR can act on.

Affected software and releases

Products and versions

1 product, 93 version entries
SourceVendorProductSchemeAffected versions
nvd apache tomcat generic 1.1.3 · 3.0 · 3.1 · 3.1.1 · 3.2 · 3.2.1 · 3.2.2 · 3.2.2:beta2 · 3.2.3 · 3.2.4 · 3.3 · 3.3.1 · 3.3.1a · 3.3.2 · 4 · 4.0.0 · 4.0.1 · 4.0.2 · 4.0.3 · 4.0.4 · 4.0.5 · 4.0.6 · 4.1.0 · 4.1.1 · 4.1.2 · 4.1.3 · 4.1.3:beta · 4.1.9:beta · 4.1.10 · 4.1.12 · 4.1.15 · 4.1.24 · 4.1.28 · 4.1.29 · 4.1.31 · 4.1.36 · 5 · 5.0.0 · 5.0.1 · 5.0.2 · 5.0.3 · 5.0.4 · 5.0.5 · 5.0.6 · 5.0.7 · 5.0.8 · 5.0.9 · 5.0.10 · 5.0.11 · 5.0.12 · 5.0.13 · 5.0.14 · 5.0.15 · 5.0.16 · 5.0.17 · 5.0.18 · 5.0.19 · 5.0.21 · 5.0.22 · 5.0.23 · 5.0.24 · 5.0.25 · 5.0.26 · 5.0.27 · 5.0.28 · 5.0.29 · 5.0.30 · 5.5.0 · 5.5.1 · 5.5.2 · 5.5.3 · 5.5.4 · 5.5.5 · 5.5.6 · 5.5.7 · 5.5.8 · 5.5.9 · 5.5.10 · 5.5.11 · 5.5.12 · 5.5.13 · 5.5.14 · 5.5.15 · 5.5.16 · 5.5.17 · 5.5.18 · 5.5.19 · 5.5.20 · 5.5.21 · 5.5.22 · 5.5.23 · 5.5.24 · ≤ 5.5.25

References

URLTags
http://www.webapp-security.com/wp-content/uploads/2013/11/Apache-Tomcat-5.5.25-CSRF-Vulnerabilities.txt Exploit

Timeline
Published2013-11-13By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.